Insider Risk Manager

Overview

In this role you will lead and mature Kingfisher’s insider risk program, shaping controls and colleague awareness to prevent data loss, policy breaches and account compromise. You will collaborate with Information Security, Technology, Legal, Privacy and People teams to reduce internal risks and protect customers and colleagues. You’ll deliver targeted awareness initiatives, support phishing simulations, and drive governance around incident triage and reporting. This is a chance to influence security culture and risk posture across a large, multi-brand organisation.

Pay / Benefits

• competitive benefits package
• opportunities to stretch and grow your career
• hybrid working model

Responsibilities

• Develop and continuously improve the insider risk programme across people, process, data and technology controls
• Identify, assess and mitigate insider risk scenarios (data leakage, policy breaches, inappropriate access, compromised accounts)
• Partner with Information Security, Technology and business teams to strengthen preventative controls, monitoring and data protection measures
• Deliver targeted awareness, communications and training to promote secure behaviours
• Support phishing simulations and other colleague-focused security initiatives, with insights for improvement
• Coordinate triage, investigation and escalation of suspected insider risk events with governance and confidentiality
• Produce meaningful reporting and insights to identify trends, measure control effectiveness and inform improvements

Key requirements

• Experience in information security, cyber risk, insider risk, data protection, security operations or similar risk-focused environment
• Strong understanding of insider risk scenarios (data loss, privileged access misuse, policy violations, account compromise)
• Experience supporting investigations, incident response, risk assessments or security monitoring
• Ability to analyse data, security alerts and behavioural trends to identify risks and gaps
• Strong stakeholder management and communication skills; ability to explain complex topics to diverse audiences
• Knowledge of frameworks and standards such as ISO 27001, NIST, CIS Controls, GDPR or equivalent (beneficial)

• Stakeholder management
• Clear communication
• Ability to translate technical topics for non-technical audiences
• Insider risk management
• Data protection
• Security operations

…